Method and apparatus of communicating security/encryption information to a physical layer transceiver

ABSTRACT

An apparatus for providing link layer security in a Physical Layer Transceiver (PHY) is disclosed. In one embodiment, the apparatus may comprise analog circuitry configured to interface with a data transmission medium, digital circuitry configured to interface with a Media Access Controller (MAC); and a crypto engine coupled to the digital circuitry. Single interface and multiple interface schemes are provided to control both PHY and crypto functions. Embodiments are disclosed where the PHY controls the crypto device, and where the crypto device controls the PHY.

RELATED APPLICATIONS

This application is a continuation of and claims the benefit of U.S.patent application Ser. No. 12/752,963, entitled “Method and Apparatusof Communicating Security/Encryption Information to a Physical LayerTransceiver,” filed on Apr. 1, 2010, which is incorporated by referenceherein; and, this application also claims the benefit of U.S.application Ser. No. 10/676,384, filed on Sep. 30, 2003, entitled“Method and Apparatus of Communicating Security/Encryption Informationto a Physical Layer Transceiver”, which is also incorporated herein byreference for all purposes.

BACKGROUND

1. Field of the Disclosure

The disclosure relates generally to link layer data communications.

2. The Prior Art

Background

Physical Layer Transceivers (“PHY” or “PHYs”) are known in the art fortransmitting and receiving data through various media, such as copperand fiber optic cables.

In a receive mode, the PHY functions as a device that receives data fromthe medium and decodes the data into a form appropriate for thereceiving device. In a transmit mode, the PHY takes data from thedevice, typically from the Media Access Controller (“MAC”), and convertsthe data into a form appropriate for the medium in use.

FIG. 1 is a functional block diagram of a typical prior art PHY 100. ThePHY 100 is typically configured to interface between the MAC 110 of thehost device and the medium 120.

The PHY 100 typically includes analog circuitry 130 configured forreceiving data from the medium 120 and decoding the data into a formappropriate for the host device using techniques known in the art. ThePHY 100 further includes digital circuitry 140 configured for receivingdata from the MAC 110 and converting the data into a form appropriatefor the medium 120.

The PHY 100 further includes memory and control circuitry 150 configuredto control the operation of the PHY, and in particular the digitalcircuitry 140. The memory and control circuitry 150 will typicallyinclude circuitry to interface with the MAC 110 through a bus interface160, such as a Medium Independent Interface (“MII”), or a Gigabit MediumIndependent Interface (“GMII”).

BRIEF DESCRIPTION OF THE DRAWING FIGURES

FIG. 1 is a conceptual block diagram of a prior art PHY.

FIG. 2 is a conceptual block diagram of a data transmission system.

FIG. 3 is a conceptual block diagram of a PHY.

FIG. 4 is a flowchart of a method for providing link layer security.

FIG. 5 is a flowchart of a method for managing packet collisions using acrypto engine.

FIGS. 6a-6e are conceptual block diagrams showing various embodiments ofproviding communication between a PHY and associated security logic.

DETAILED DESCRIPTION

Persons of ordinary skill in the art will realize that the followingdescription is illustrative only and not in any way limiting. Othermodifications and improvements will readily suggest themselves to suchskilled persons having the benefit of this disclosure. In the followingdescription, like reference numerals refer to like elements throughout.

This disclosure may relate to data communications. Various disclosedaspects may be embodied in various computer and machine readable datastructures. Furthermore, it is contemplated that data structuresembodying the teachings of the disclosure may be transmitted acrosscomputer and machine readable media, and through communications systemsby use of standard protocols such as those used to enable the Internetand other computer networking standards.

The disclosure may relate to machine readable media on which are storedvarious aspects of the disclosure. It is contemplated that any mediasuitable for retrieving instructions is within the scope of the presentdisclosure. By way of example, such media may take the form of magnetic,optical, or semiconductor media, and may be configured to be accessibleby a machine as is known in the art

Various aspects of the disclosure may be described through the use offlowcharts. Often, a single instance of an aspect of the presentdisclosure may be shown. As is appreciated by those of ordinary skill inthe art, however, the protocols, processes, and procedures describedherein may be repeated continuously or as often as necessary to satisfythe needs described herein. Accordingly, the representation of variousaspects of the present disclosure through the use of flowcharts shouldnot be used to limit the scope of the present disclosure.

This disclosure provides security at the link layer of a system. In thisregard, the link layer may be defined in accordance with the OSIreference standard. In particular, the I.E.E.E. 802.3 standard definesthe link layer as devices residing between the MAC and medium, and is sodefined herein.

In this disclosure, link layer security is provided in a transmissionmode by encrypting data for confidentiality, authenticating data forintegrity, or both as it is received from the MAC and prior beingtransmitted from the PHY. Conversely, in a receive mode, data isdecrypted, authenticated, or both as it is received by the PHY, prior topresentation to the MAC.

FIG. 2 is a diagram of a link layer data transmission system 205configured in accordance with the teachings of this disclosure. Thesystem 205 includes a transmitting device 200 coupled to a receivingdevice 260 through a medium 240.

The transmitting device 200 includes an ASIC configured to function as aMAC using techniques known in the art, and a PHY 230, such as thatdescribed in FIG. 1.

Coupled between the MAC 210 and the PHY 230 is a crypto device 220. Thecrypto device 220 is preferably configured to encrypt/authenticate thedata packet 250 using DES, 3DES, MD5, SHA1, RC4, or AES, or othersimilar protocols.

In this example, the data packet is received by the crypto device 220from the MAC 210, and encrypted/authenticated prior to being provided tothe PHY 230 and transmitted onto medium 240.

The system 205 also includes a receiving device 260 that is configuredsimilar to the transmitting device 200, including a MAC 270, a cryptodevice 280, and a PHY 290.

In the receiving device, the ciphered data packet 250 is received by thePHY 290 and provided to the crypto engine 280, where the data isdecrypted/authenticated and provided to the MAC 270.

Of course, the operation disclosed in FIG. 2 may operate in the reversepath.

FIG. 3 is a conceptual block diagram of a further embodiment of a PHYconfigured in accordance with the teachings of this disclosure.

The embodiment of FIG. 3 provides that the crypto device is deployed onthe same chip as the PHY, providing a single-chip link layer securitysolution.

The device 300 includes a MAC 310 and a PHY 305. The PHY 305 includesanalog circuitry 330 configured in a receive mode for receiving datafrom the medium 350 and decoding the data into a form appropriate forthe host device using techniques known in the art. In a transmit mode,the analog circuitry is configured to receive data from the MAC 310, andconvert it into a form appropriate for the medium 350.

The PHY 305 further includes digital circuitry 320 configured forreceiving data from the MAC 310 and converting the data into a formappropriate for the medium 350 in a transmit mode, and for receivingdata from the analog circuitry 330 and converting it into a formatappropriate for the MAC 310 in a receive mode.

The PHY 305 further includes memory and control circuitry 325 configuredto control the operation of the PHY, and in particular the digitalcircuitry 320. The memory and control circuitry 325 will typicallyinclude circuitry to interface with the MAC 310 through a bus interface360, such as a MII or a GMII or XGMII or XAUI or SGMII or RGMII.

The PHY 305 also includes a crypto module 340 coupled to the digitalcircuitry 320. The crypto module may include control and memorycircuitry 345 for operation of the cryptographic functions. The cryptomodule 340 is preferably configured to encrypt/authenticate datareceived from the MAC 310 prior to presentation to the analog circuitry330, and decrypt/authenticate data received from the analog circuitry330 prior to presentation to the MAC 310. The crypto module may employthe cryptographic techniques disclosed above.

In a further embodiment, the crypto device 340 may be deployed usingexisting hardware already present in the PHY. It will be appreciatedthat by reusing existing hardware already present on the PHY to enablecrypto features, significant real estate savings in the device mayresult.

It is contemplated that a wide array of PHY components may be reusedwhen implementing the disclosed cryptographic features. For example, thecrypto device may reuse the PHY' s pin or interface layout, memory map,various elements of the state machine, logic gates, or even one or moreof the above. Likewise, devices exist that contain multiple PHYs, suchas an Octal PHY that contain 8 PHY interfaces. In these devices thereuse of pins and other elements that already exist in the PHY canreduce die and package size, thus making the devices less expensive tomanufacture.

Similarly some chips incorporate the MAC as a portion of the PHY chip.In this case it may be possible to take advantage of elements from boththe MAC and the PHY.

It is also contemplated that the additional functionality provided bythe crypto device may be utilized for other functions or features. Forexample, the crypto device may be configured to perform datacompression.

For example, in one embodiment, the device 300 of FIG. 3 may comprise arouter in which the MAC 310 comprises an ASIC configured to alsofunction as a switching fabric. In this case, there many be many PHYspresent in the device, and by cross-utilizing the pre-existing structureof the PHY, additional security features may be added without additionalchips.

In a further disclosed embodiment, the crypto device may be employed toimprove the overall performance and reliability of a data transmissionsystem.

As is appreciated by those of ordinary skill in the art, many suchdevices operate using a half duplex mode, where a common performanceissue is the collision of data packets.

It is contemplated that the additional functionality provided by theencryption device may improve collision management.

In this embodiment, the encryption memory 345 may be employed totemporarily store the data and associated security information as thepacket is transmitted. If a collision is detected, the storedinformation may be immediately reused and resent, without the need forthe processor or MAC to resend the data, or to send new securityinformation such as a security association.

As will be appreciated by those having the benefit of this disclosure,this benefit may save processor cycle time, and may also improveperformance by offloading some processing time from ASIC to the PHY.

It is contemplated that the crypto device may take advantage of certainareas of memory on the PHY. If the PHY complies with certain industrystandards, such as I.E.E.E. 802.3, PHYs are provided with certainregisters of memory that are reserved for specific purposes, known asthe MII Management Interface. For example, registers 11-14 are reserved,and registers 16-31 are vendor-specific areas.

It is contemplated that security association database (SAD) used in thepresent disclosure may be directed to be written to certain areas in apredetermined order. For example, one bit in register 11 could be usedto turn the crypto function on or off. Likewise, the crypto may needdata, such as a key or security association, to perform a cryptofunction. This data could be accessed through register 12. This takesadvantage of memory management techniques and structure already present.Of course, other registers may be used.

Another benefit of this disclosure may be realized as reduced traffic,as the PHY could be programmed to drop or “trash” received traffic thatdoes not pass the decryption module. In this example, data that does notproperly decrypt is flagged to be dropped by a subsequent module priorto being switched by the switching fabric, saving bandwidth in theswitching fabric for other important functions. This could reduce therisk of an unauthorized user from bringing down a network or networkeddevice due to denial of service attacks, thereby enhancing thereliability of the network. Alternatively, the security logic mayinterrupt the processor for further action.

FIG. 4 is a flowchart of a method of encrypting/authenticating data atthe link layer of a data transmission system. In act 400, the PHYswishing to communicate may auto-negotiate a link using techniques knownin the art. It is to be understood that the encryption/authenticationtechniques disclosed herein may also be applied prior toauto-negotiation of a link.

In act 410, the MAC of the transmitting PHY (“TX PHY”) provides the datato be transmitted to the crypto engine. In act 420, the data is cipheredby the crypto engine and placed on the medium linking the PHYs by the TXPHY.

In act 430, the receiving PHY (“RCV PHY”) receives the cipher data fromthe link and presents the data to the RCV PHY' s crypto engine, wherethe data is decrypted, authenticated, or both.

In act 440, the plain data is then passed to the MAC of the RCV PHY.

FIG. 5 is a flowchart of a method for managing packet collisions using acrypto engine.

In act 500, the MAC of the TX PHY provides the data to be transmitted tothe crypto engine. In act 520, the data is encrypted, authenticated orboth by the crypto engine and placed on the medium linking the PHYs bythe TX PHY. As mention above, the PHYs wishing to communicate mayauto-negotiate a link using techniques known in the art, but the datamay also be encrypted prior to auto-negotiation of a link. At thispoint, the encrypted/authenticated data is stored by the encryptionengine.

In query 530, the PHY determines whether a packet collision hasoccurred. If a collision has occurred, the stored packet isre-transmitted by the TX PHY. If no collision occurs, the communicationprocess proceeds as normal and any data stored could be flushed or usedspace reclaimed.

FIGS. 6a-6e are conceptual block diagrams showing various embodiments ofproviding communication between a PHY and associated security logic.

Referring generally to FIGS. 6a -6 e, the device 600 includes a PHY 605and crypto device security logic 620. It is to be understood that thedisclosed embodiments may be implemented with the PHY and security logicdeployed as either a one- or multiple-chip solution.

The PHY 605 and security logic 620 each include a communications module610 and 625, respectively, configured to interface through a link 630.MAC data is presented to the PHY 605 through interface 640, and datasignals are transmitted and received on the link medium 650.

In the embodiments disclosed herein, it is contemplated that anyinterface may be employed to communicate with the crypto device, such asMDIO/MDC (I.E.E.E. 802.3 PHY interface), S2W (Serial-to-Wire interface),I2C, or PCI (Peripheral Component Interface).

Referring first to FIG. 6a , an embodiment is disclosed where theMDIO/MDC interface 645 of the PHY 605 is utilized to control the cryptoprocess. The security information is passed to the PHY using theMDIO/MDC interface, and the PHY then decodes the security informationand controls the security logic by communicating through the link 630.

In this embodiment, the security information may be passed topredetermined memory registers in the communications module 610 of thePHY 605, and then communicated to the security logic 620 using controlsignals, a FIFO, or other techniques known in the art, such as a statemachine.

In a further embodiment, the communications modules of the PHY andsecurity logic may be configured such that only security parameters arecommunicated over the link.

Referring now to FIG. 6b , an embodiment is shown where an interface 655is provided that operates using a protocol other than MDIO/MDC. Thisembodiment uses separate interface 655 coupled directly to thecommunications module 625 of the security logic 620. Thus, the cryptoinformation is provided directly to the crypto device at the PHY layer.

Referring now to FIG. 6c , an embodiment is shown whereby PHY logic isincorporated in to the security logic and coupled to the PHY throughlink 660, and the MDIO/MDC interface 645 is utilized to control both thePHY 605 and security logic 620.

This embodiment thus provides the MDIO/MDC interface to both the PHY andsecurity logic. It is contemplated that in this embodiment, the PHY andthe security logic may be configured to read separate areas of the PHYregister memory space. It is further contemplated that this embodimentis especially advantageous for single-chip solutions.

Referring now to FIG. 6d , an embodiment is shown where a mastercommunications module 670 is provided to interface with link 655. Inthis embodiment, the master communications module 670 is provided toprovide connectivity using a communications protocol other than theMDIO/MDC protocol.

The master communications module 670 is then coupled to both the PHY andsecurity logic to provide control to each. The master communicationsdevice 670 may communicate with the PHY 605 and security logic 620 usingan MDIO/MDC interface.

It will be appreciated that the MDIO/MDC interface may be optional, andcontrol may be provided through the interface link 655.

Referring now to FIG. 6e , an embodiment is provided where the MDIO/MDCinterface 655 is provided directly to the security logic, and thecommunications module 625 of the security logic 620 provides controlsignals for the PHY 605. The security logic 620 and PHY 605 maycommunicate using an MDIO/MDC interface. It is contemplated that minorregisters may be provided in the communications modules of both the PHYand security logic.

In a further embodiment, the communications module of the security logicmay be configured to interface using a protocol other than the MDIO/MDCprotocol, and then control the PHY using an MDIO/MDC interface. It iscontemplated that this embodiment may be useful to control multipledevices residing on the same chip.

Additionally, the communications modules of the PHY and security logicmay be configured such that only security parameters are communicatedover the link.

In a further embodiment, the security logic may be configured toperiodically poll the registers of the PHY and update the contents ofthe registers of the security logic. Additionally, cache memory may beprovided to allow the PHY to communication through the security deviceusing memory paging techniques.

While embodiments and applications of this disclosure have been shownand described, it would be apparent to those skilled in the art thatmany more modifications and improvements than mentioned above arepossible without departing from the inventive concepts herein. Thedisclosure, therefore, is not to be restricted except in the spirit ofthe appended claims.

What is claimed is:
 1. An apparatus for providing link layer securitycomprising: a Physical Layer Transceiver (PHY) communication moduleconfigured to transmit data/control signals to, and receive data/controlsignals from, a Media Access Controller (MAC); a crypto communicationsmodule including components configured to perform cryptographicfunctions on data associated with the MAC; an interface link operativelycoupling the PHY communication module to the crypto communicationsmodule, wherein at least some of the components configured to performcryptographic functions are integrated with components of the PHYcommunication module;
 2. The apparatus of claim 1, wherein the PHYcommunication module comprises analog circuitry configured to transmitto, and receive data from, a data transmission medium.
 3. The apparatusof claim 1, wherein the crypto communications module further comprises acrypto engine at least partially integrated with the PHY communicationmodule.
 4. The apparatus of claim 1, wherein the cryptographic functionsinclude at least some of encrypting data received from the MAC,decrypting data prior to presentation to the MAC, and authenticatingdata.
 5. The apparatus of claim 1, further comprising a mastercommunications module configured to communicate with both of the PHYcommunications module and the crypto communications module via theinterface link.
 6. The apparatus of claim 1, wherein the PHYcommunications module is configured to provide connectivity through aMDIO/MDC interface, and the crypto communications module is configuredto provide connectivity through an interface other than a MDIO/MDCinterface.
 7. The apparatus of claim 1, wherein the PHY communicationsmodule is configured to drop traffic that does not pass the decryptionor flag the traffic that does not pass the decryption for dropping byanother module.
 8. The apparatus of claim 1, wherein he PHY controls theoperation of the crypto communications module.
 9. The apparatus of claim1, wherein the plurality of job executors comprises a plurality ofthreads.